Privacy Policy

We collect personal information in the following ways:

• Contact and enquiry forms.When you submit a form on our website (including the contact page, the “Let’s Talk” panel and the enquiry forms on product, platform and solution pages) we collect your name, company name, email address, phone number, your message and the page from which you enquired.
• Direct correspondence. Information you share with us by email, phone or messaging apps when discussing an enquiry or engagement.
• Engagement data. Business information, content and credentials a client provides so that we can deliver contracted work.
• Technical data. Our hosting and security providers may automatically log standard technical details (such as IP address, browser type and pages requested) to serve the site and protect it from abuse.

We do not knowingly collect personal information from children, and our website is not directed at them.

We use personal information to:

• respond to your enquiries and requests;
• prepare proposals and deliver the products and services a client has engaged us for;
• administer accounts, invoicing and business records;
• operate, secure and improve our website and products; and
• comply with legal obligations.

We do not sell personal information, and we do not use your enquiry details for unsolicited marketing lists.

Where data protection law (including Sri Lanka’s Personal Data Protection Act and, where applicable, the EU/UK GDPR) requires a legal basis, we rely on:

• Contract — to respond to your enquiry, prepare proposals and deliver services you or your company have engaged us for;
• Legitimate interests — to operate, secure and improve our website and products, maintain business records and correspond about our services, balanced against your rights and expectations;
• Consent — where we ask for it expressly, which you may withdraw at any time; and
• Legal obligation — where processing is required to comply with applicable law, such as tax and accounting requirements.

Form submissions are transmitted securely and delivered to our team as email via a reputable transactional email provider acting as our processor. The details you submit are used to respond to you and are retained as part of our business correspondence.

We share personal information only with service providers who help us operate — such as website hosting and content delivery, transactional email delivery, and productivity tools our team uses — and only to the extent needed to provide their service. These providers are bound by their own contractual and legal confidentiality obligations. We may also disclose information where required by law, or in connection with a business reorganisation, in which case this Policy will continue to apply to it.

We operate from Sri Lanka with a presence in Dubai and Singapore, and our service providers may process data in other countries. Where personal information is transferred across borders, we take reasonable steps to ensure it receives an adequate standard of protection consistent with this Policy and applicable data protection laws, including Sri Lanka’s Personal Data Protection Act.

We do not use advertising cookies. Essential technical storage may be used to make the site function correctly. We use Google Analytics to understand how the website is used — such as which pages are visited, approximate location and device type — in aggregate form. Google Analytics sets its own cookies and is operated by Google as our processor; you can opt out using Google’s browser opt-out tools or by blocking analytics cookies in your browser settings.

We apply appropriate technical and organisational measures to protect personal information — including encrypted transmission (HTTPS), reputable cloud infrastructure, access controls and the principle of least privilege. No method of transmission or storage is completely secure, but we work to protect your information against unauthorised access, alteration and loss.

If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the applicable supervisory authority and affected individuals without undue delay, in accordance with applicable law, and take prompt steps to contain and remediate the breach.

We keep personal information only as long as needed for the purposes described above: enquiry correspondence for as long as it remains relevant to the relationship, engagement records for the duration of the engagement and any legally required retention period, and financial records as required by law. When information is no longer needed, we delete or anonymise it.

As a guide:

• enquiry correspondence that does not lead to an engagement — up to two (2) years from last contact;
• client engagement records — the duration of the engagement plus up to six (6) years, reflecting contractual limitation periods; and
• invoicing and financial records — as required by applicable tax and accounting law.

Subject to applicable law, you may ask us to: access the personal information we hold about you; correct inaccurate information; delete information we no longer need; restrict or object to particular processing; receive a portable copy of data you provided to us; withdraw consent where processing is based on consent; or stop contacting you. You also have the right to lodge a complaint with your supervisory authority — in Sri Lanka, the Data Protection Authority established under the Personal Data Protection Act. To exercise any of these rights, email [email protected] and we will respond within a reasonable timeframe.

Our website may link to external sites and services. We are not responsible for their privacy practices, and we encourage you to review their policies before providing them with personal information.

We may update this Policy from time to time. The latest version will always be published on this page with its effective date. Material changes will be highlighted on the website where appropriate.